Firebase permission denied when checking unique username

Question

I want to check if the username already is in use. This function gets called when the current user does not have a child of "username":

func createUsername()
{
    let userID = FIRAuth.auth()?.currentUser?.uid
    FIRDatabase.database().reference().updateChildValues([
        "users/\(userID!)/username": username.text!,
        "usernames/\(username.text!)": userID!
        ], withCompletionBlock: { (error, reference) in
            if (error != nil) {
                print("disallowed")
                // Write was disallowed because username exists
            }
    })
}

In combination with this rules:

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid",
        "username": {
      ".read": true,
          ".write": "!data.exists() && newData.exists()",
          ".validate": "newData.isString()"
        }
      }
    },
    "usernames": {
      "$username": {
        ".read": true,
        ".write": "!data.exists() && newData.exists()",
        ".validate": "newData.isString() && newData.val() == root.child('users/' + auth.uid + '/username').val()"
      }
    }
  }
}

I got the answer from: https://groups.google.com/forum/#!topic/firebase-talk/dA1Lkykd-tk I get this error message:

[Firebase/Database][I-RDB03812] updateChildValues: at / failed: permission_denied

I am not sure why this wont work. I also tried this answer: Firebase android : make username unique But this did not work for me. There is something wrong with the rules but I dont know what.

Update, little change in rules, still same error:

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "$uid === auth.uid",
        ".write": "$uid === auth.uid",
        "username": {
      ".read": true,
          ".write": "!data.exists() && newData.exists()",
          ".validate": "newData.isString()"
        }
      }
    },
    "usernames": {
      "$username": {
        ".read": true,
        ".write": "!data.exists() && newData.exists()",
        ".validate": "newData.isString() && newData.val() == newData.parent().parent().child('users/' + auth.uid + '/username').val()"
      }
    }
  }
}

I also changed the parent() things, but it wouldn't work aswell. I changed to 4 parents, and 0 parents. Same error.

Frank van Puffelen · Accepted Answer · 2017-02-12T16:16:22.097

Update: The problem comes from this validation rule:

".validate": "newData.isString() && newData.val() == root.child('users/' + auth.uid + '/username').val()"

You're comparing the new data against the current root. Since the user has just been created /users/$uid won't yet exist.

What you want to do is compare the new data against the new users node. To get to this node, you should navigate from newData up to the new root when comparing:

".validate": "newData.isString() && 
  newData.val() == newData.parent().parent().child('users/' + auth.uid + '/username').val()"

I'll leave my previous response below, since it may prove useful in learning how to troubleshoot a problem like this.

I just pasted your rules into a project of mine, simplified them a bit and used your code without problems. I'm not sure why you're having a problem.

The code:

    FIRAuth.auth()?.signInAnonymously(completion: { (user, error) in
        let username = "puf"
        let userID = FIRAuth.auth()?.currentUser?.uid
        self.ref.child("42188459").updateChildValues([
            "users/\(userID!)/username": username,
            "usernames/\(username)": userID!
        ], withCompletionBlock: { (error, reference) in
            if (error != nil) {
                print("disallowed")
                // Write was disallowed because username exists
            }
        })
    })

The rules snippet:

  "users": {
    "$uid": {
      ".write": "$uid === auth.uid",
      "username": {
        ".write": "!data.exists() && newData.exists()",
      }
    }
  },
  "usernames": {
    "$username": {
      ".write": "!data.exists() && newData.exists()",
    }
  }

The resulting JSON:

{
  "usernames" : {
    "puf" : "DBP4Pw3uiwQfUaDJw1XBR8oFBUK2"
  },
  "users" : {
    "DBP4Pw3uiwQfUaDJw1XBR8oFBUK2" : {
      "username" : "puf"
    }
  }
}

I copied your update rule and replaced it with the old values. However, I still get the an error. This error occurs at the line .validate, the rule I just copied. In the simulator in Firebase, I also get the error. I had these settings: Write, location: /usernames/dfggdfg/, json values: { "key": "value" }, verified: YES, then execute. Reading works, but writing still has some issues. The rest of the rules are exactly the same as stated above. I will update the current rules I am using. XCode still gives the same error. — NoKey, Feb 12 '17 at 21:57

Firebase permission denied when checking unique username

1 Answers1